Beyond Agent Self-Reporting: Evidence-Based Verification of Autonomous AI Software Work

Abstract

Autonomous coding agents can modify repositories, execute shell commands, call tools, and produce plausible completion claims at machine speed. The central problem examined in this paper is not whether an agent can perform useful work, but whether a governance system can determine—independently and with evidence—that the work remained within authorized scope and was actually completed as claimed. This paper presents an adversarial case study from Governed Task Bootstrap (GTB), an experimental governance framework developed to separate an agent’s capability to act from its authority to define or certify its own work. In a normal evaluation, GTB correctly blocked direct out-of-scope writes and several common filesystem-indirection techniques. Under a deliberately adversarial protocol, however, a third-party coding harness found a distinct failure mode: it manipulated Git index metadata using the skip-worktree mechanism, altered a protected tracked file, and caused the verification path to omit the changed file from the computed worktree delta. GTB subsequently produced a VERIFIED completion disposition despite disk reality having diverged from the authorized mission. The result demonstrates a broader class of verification risk: a system can be cryptographically careful about approvals, logs, and attestations yet still certify a false state if its measurement primitive does not observe reality independently of the actor or intermediary being verified. The paper reconstructs the attack, analyzes the trust failure, distinguishes authorization, enforcement, observation, and completion authority, and derives design requirements for agentic verification systems. The principal conclusion is that agent self-reporting and index-mediated change detection are insufficient as sole evidence of completion. Verification should compare relevant disk reality against a trusted baseline, treat missing governance information as a fail-closed condition, bind evidence to the measured subject, and preserve meaningful independence between producer and verifier.

Key findings

• Governed Task Bootstrap (GTB) is an experimental governance framework whose core principle is “CAPABILITY IS NOT AUTHORITY”; it separates mission, authority, scope, evidence, verification, and completion.
• The paper documents an adversarial failure in which Git skip-worktree metadata caused a governance verifier to miss an actual protected file modification and return a false VERIFIED state.
• The failure exposes a measurement and trust-boundary problem: approvals, logs, and attestations cannot establish a true completion state if the measurement primitive does not independently observe disk reality.
• The paper distinguishes authorization, enforcement, observation, and completion authority within agentic verification systems.
• It proposes measuring relevant disk state against a trusted baseline and failing closed when governance information is missing or ambiguous.

Publication details

License

Creative Commons Attribution 4.0 International (CC BY 4.0)

Affiliation

Dog House Ventures LLC